feat(database): shape the library like files, and shrink the catalog

Plans 013 and 014, the album page that prompted them, and the smaller
fixes they turned up. Changelog, largest first.

## The local library is shaped like files, not like MusicBrainz

`audio_files` carries its own tags and points at `albums` and
`artists`; `file_genres` is the one real many-to-many. `recordings`,
`release_group_recordings`, `artist_credit`, `artist_credit_artist`,
`recording_genres`, `release_groups` and `release_to_rg` are gone from
the local side, and with them a six-way join in every read, a
`MIN(release_group_id)` subquery in eleven queries and a
first-credited-artist subquery in nine. Measured on a real 25,966-file
library, every many-to-many that model expressed was 1:1 in the data.

- Ownership is a file. `GetFilePathsByRecordingMBIDs`,
  `LibraryMBIDIndex.CheckMBIDs`, `collectLibraryEntities` and
  `pruneStaleLocalCrossReferences` all join `audio_files`, so the 812
  orphaned recordings, 216 release groups and 260 artists that library
  carried are now structurally impossible.
- One projection: every track query selects from the `track_metadata`
  view, one row type, one mapper. Nine hand-rolled copies had drifted
  far enough to report different years on different screens.
- `library_id = 0` means every library, so each list query exists once
  instead of scoped and unscoped with a branch at every call site.
- No migration chain. `sql/schemas/` is the one description of the
  shape; `sql/migrations/`, `applyMigrations` and `schema_migrations`
  are squashed away, along with the drift between them that had sqlc
  generating against a stale schema.
- `database.InsertTestTrack` is the one test seeder; twenty test files
  had been assembling the old FK chain each in its own order.

## The catalog stores its ids as bytes

`explore_index`'s three 36-char MBID columns and its entity-type text
are 16 raw bytes and a small integer. The table and its six indexes go
780 MB to 405 MB on a real 2,052,200-row catalog, which is why a fresh
install is ~0.6 GB rather than ~1.0 GB.

- `backend/explore/mbid.go` is the only place the encoding is known;
  everything above it speaks dashed strings.
- `CHECK(length(mbid) = 16)` makes a stringly write fail at the insert
  rather than silently returning no rows, since SQLite does not coerce
  between TEXT and BLOB.
- The importer asks the artifact what encoding it carries and converts
  on the way in, so the artifact already published keeps working and no
  format bump is needed.
- `indexRowColumns`/`scanIndexRow` replace four copies of a 22-column
  list, and `TestStoredEncodingRoundTrips` sweeps every read path.

## An album page that says how much of the album is yours

- One question, asked once: is there a file. `filePaths` is filled by a
  single batched lookup when the tracklist settles, and the badge, the
  Play count, the dimmed rows and every menu item read it — replacing
  four claims of decreasing confidence that could show a green tick on
  an album whose every action did nothing.
- Play, Play 7 of 12, or no play button at all.
- `total_tracks` on `explore_index` (~2 bytes over 400,677 release
  groups) and on `audio_files` from tags that have always carried it:
  a complete MBID-matched album now makes no catalog call at all, where
  it used to spend the most expensive request the app makes.
- A merged cluster shows the running order the most releases agree on,
  and the version list marks the release you own rather than standing a
  synthetic entry in for it.
- `AlbumReleasesFailed`: a slow fetch is no longer reported as a failed
  one by a 12-second timer.
- Rows not in the library are dimmed in place (with `aria-disabled`)
  instead of the owned ones wearing a green tick and a legend.

## Caches and cover art get ceilings

- Only the three tiers of a cover are stored; the full-resolution copy
  nothing rendered was 1,134 MB of a 1.4 GB covers directory.
- One artist portrait is downloaded and the rest are remembered as
  URLs — 4.1 GB of a 5.3 GB cache was candidates no code path reads.
- `browsedArtBudget` and `httpCacheBudget` bound what an age cannot:
  the same install held art for 5,770 artists in a 1,301-artist
  library.
- `OrphanedArtistImagesJob` joined a bare MBID onto a sharded
  directory, so it deleted the rows that were the only record of the
  files it left behind. `explore.ArtistImageDir` is that layout's one
  definition now.

## The autotag queue asks whether there is work

`tagging_items` was a row per album folder, not a queue, and no query
read the `tag_status` column that held the answer. The four queue
queries ask the files, which matters most where it is least visible:
`startPrefetch` was scoring every album in a tagged library against
MusicBrainz.

## Phantom playlist tracks resolve in place

An M3U8 imported before its files leaves phantom rows; they now match
by path and fall back to position, keep their place in the playlist
when resolved, and pair best-first so two phantoms cannot claim the
same file.

## Playing a track plays the list it is in

Double-click, and Play on a single row's menu, queue the list as
displayed with `startIndex` on that row — the album page and the track
list used to queue one track and discard the album around it. A
multi-row selection still plays exactly itself.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AfVYUVExXsx1nSWrXN8mAh

backend/maintenance/maintenance_test.go

@@ -3,6 +3,7 @@ package maintenance
 import (
 	"context"
 	"errors"
+	"fmt"
 	"log/slog"
 	"os"
 	"path/filepath"
@@ -319,12 +320,14 @@ func TestOrphanedArtistImagesJob(t *testing.T) {
 		}
 	}
 
-	// The owned artist is in the library.
-	if _, err := db.ExecContext(
-		`INSERT INTO artists (name, mbid) VALUES ('Owned', ?)`, ownedMBID,
-	); err != nil {
-		t.Fatalf("seed artists: %v", err)
-	}
+	// The owned artist is in the library - which means a *file* says
+	// so.  An artists row on its own is the phantom the file-shaped
+	// schema removed, and it is not ownership.
+	database.InsertTestTrack(t, db, database.TestTrack{
+		FilePath:   "/music/owned.mp3",
+		Artist:     "Owned",
+		ArtistMBID: ownedMBID,
+	})
 
 	old := time.Now().Add(-200 * 24 * time.Hour)
 
@@ -521,3 +524,145 @@ func TestStrayArtistImageFilesJobRefusesEmptyKeepSet(t *testing.T) {
 		t.Error("an empty keep set emptied the directory")
 	}
 }
+
+// TestOrphanedArtistImagesJob_EvictsOverBudget pins the ceiling.
+//
+// Age alone bounds nothing: a browsing session fetches portraits for
+// hundreds of artists in an afternoon and every one of them is inside
+// the retention window. A real install held art for 5,770 artists in a
+// 1,301-artist library. Art for an artist the user owns is outside the
+// budget and must survive an eviction that takes everything else.
+func TestOrphanedArtistImagesJob_EvictsOverBudget(t *testing.T) {
+	t.Parallel()
+
+	db := database.NewTestDB(t)
+	dir := t.TempDir()
+
+	const ownedMBID = "aaaaaaaa-0000-0000-0000-000000000000"
+
+	database.InsertTestTrack(t, db, database.TestTrack{
+		FilePath:   "/music/owned.mp3",
+		Artist:     "Owned",
+		ArtistMBID: ownedMBID,
+	})
+
+	// Each artist's art is a quarter of the budget, so four browsed
+	// artists sit exactly on it and the fifth pushes it over.
+	blob := make([]byte, browsedArtBudget/4)
+
+	seed := func(mbid string, created time.Time) {
+		t.Helper()
+
+		artistDir := explore.ArtistImageDir(dir, mbid)
+		if err := os.MkdirAll(artistDir, 0o755); err != nil {
+			t.Fatalf("mkdir %s: %v", mbid, err)
+		}
+
+		if err := os.WriteFile(
+			filepath.Join(artistDir, "primary.jpg"), blob, 0o600,
+		); err != nil {
+			t.Fatalf("write image: %v", err)
+		}
+
+		if _, err := db.ExecContext(
+			`INSERT INTO artist_images
+			   (artist_mbid, source, source_url, file_path, created_at)
+			 VALUES (?, 'test', 'http://x', ?, ?)`,
+			mbid, filepath.Join(artistDir, "primary.jpg"), created,
+		); err != nil {
+			t.Fatalf("seed artist_images for %s: %v", mbid, err)
+		}
+	}
+
+	// All inside the retention window, so only the budget can evict.
+	now := time.Now()
+	seed(ownedMBID, now)
+
+	browsed := []string{
+		"bbbbbbbb-0000-0000-0000-000000000000",
+		"cccccccc-0000-0000-0000-000000000000",
+		"dddddddd-0000-0000-0000-000000000000",
+		"eeeeeeee-0000-0000-0000-000000000000",
+		"ffffffff-0000-0000-0000-000000000000",
+	}
+
+	for i, mbid := range browsed {
+		seed(mbid, now.Add(-time.Duration(len(browsed)-i)*time.Hour))
+	}
+
+	result, err := OrphanedArtistImagesJob(db, dir, explore.ArtistImageDir).
+		Run(context.Background())
+	if err != nil {
+		t.Fatalf("run job: %v", err)
+	}
+
+	if result.FilesDeleted == 0 {
+		t.Error("nothing was evicted despite being over budget")
+	}
+
+	// The oldest browsed artist goes first.
+	if _, err := os.Stat(explore.ArtistImageDir(dir, browsed[0])); !os.IsNotExist(err) {
+		t.Error("the least recently fetched art survived the budget pass")
+	}
+
+	// The owned artist is never in the budget.
+	if _, err := os.Stat(explore.ArtistImageDir(dir, ownedMBID)); err != nil {
+		t.Error("artwork for a library artist was evicted by the budget pass")
+	}
+
+	// And the newest browsed art survives, because eviction stops as
+	// soon as the rest fits.
+	if _, err := os.Stat(explore.ArtistImageDir(dir, browsed[len(browsed)-1])); err != nil {
+		t.Error("eviction did not stop once under budget")
+	}
+}
+
+// TestExpiredHTTPCacheJob_TrimsToBudget pins the ceiling that makes a
+// year-long entity TTL safe: once answers stop expiring, expiry stops
+// being a bound and something else has to be.
+func TestExpiredHTTPCacheJob_TrimsToBudget(t *testing.T) {
+	t.Parallel()
+
+	db := database.NewTestDB(t)
+
+	// Six rows of a third of the budget each: two fit, the rest go.
+	blob := make([]byte, httpCacheBudget/3)
+
+	for i := range 6 {
+		if _, err := db.ExecContext(
+			`INSERT INTO http_cache (url_key, response, expires_at)
+			 VALUES (?, ?, ?)`,
+			fmt.Sprintf("key-%d", i), blob,
+			time.Now().Add(time.Duration(i+1)*24*time.Hour),
+		); err != nil {
+			t.Fatalf("seed http_cache: %v", err)
+		}
+	}
+
+	if _, err := ExpiredHTTPCacheJob(db).Run(context.Background()); err != nil {
+		t.Fatalf("run job: %v", err)
+	}
+
+	var total int64
+	if err := db.QueryRowWriter(
+		"SELECT COALESCE(SUM(LENGTH(response)), 0) FROM http_cache",
+	).Scan(&total); err != nil {
+		t.Fatalf("measure http_cache: %v", err)
+	}
+
+	if total > httpCacheBudget {
+		t.Errorf("http_cache is %d bytes, over the %d budget", total, httpCacheBudget)
+	}
+
+	// The longest-lived answers are the ones kept.
+	var kept string
+	if err := db.QueryRowWriter(
+		"SELECT url_key FROM http_cache ORDER BY expires_at DESC LIMIT 1",
+	).Scan(&kept); err != nil {
+		t.Fatalf("read surviving row: %v", err)
+	}
+
+	if kept != "key-5" {
+		t.Errorf("kept %q, want the longest-lived row", kept)
+	}
+}